Re: [PATCH v2 1/2] powerpc/code-patching: add patch_memory() for writing RO text

On Sun, 2021-12-12 at 09:08 +0000, Christophe Leroy wrote:

Le 12/12/2021 à 02:03, Russell Currey a écrit :

quoted

+static int do_patch_memory(void *dest, const void *src, size_t
size, unsigned long poke_addr)
+{
+       unsigned long patch_addr = poke_addr +
offset_in_page(dest);
+
+       if (map_patch_area(dest, poke_addr)) {
+               pr_warn("failed to map %lx\n", poke_addr);

It isn't worth a warning here. If that happens before slab is
available, 
it will panic in early_alloc_pgtable().

If it happens after, you will already get a pile of messages dumping
the 
memory state etc ...

During the last few years, pr_ messages have been removed from most 
places where ENOMEM is returned.

That's good to know, thanks.

quoted

+               return -1;
+       }

I have a series reworking error handling at 
https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=274823&state=*

Especially this one handles map_patch_area() : 
https://patchwork.ozlabs.org/project/linuxppc-dev/patch/85259d894069e47f915ea580b169e1adbeec7a61.1638446239.git.christophe.leroy@csgroup.eu/

Would be good if you could rebase your series on top of it.

I've rebased on top of your series (patchwork 274258 & 274823).

quoted

+
+       memcpy((u8 *)patch_addr, src, size);

Shouldn't we use copy_to_kernel_nofault(), so that we survive from a 
fault just like patch_instruction() ?

Yes we should.

quoted

+
+       flush_icache_range(patch_addr, size);
+
+       if (unmap_patch_area(poke_addr)) {
+               pr_warn("failed to unmap %lx\n", poke_addr);
+               return -1;
+       }

I have changed unmap_page_area() to a void in 
https://patchwork.ozlabs.org/project/linuxppc-dev/patch/299804b117fae35c786c827536c91f25352e279b.1638446239.git.christophe.leroy@csgroup.eu/

quoted

+
+       return 0;
+}
+
+/**
+ * patch_memory - write data using the text poke area
+ *
+ * @dest:      destination address
+ * @src:       source address
+ * @size:      size in bytes
+ *
+ * like memcpy(), but using the text poke area. No atomicity
guarantees.
+ * Do not use for instructions, use patch_instruction() instead.
+ * Handles crossing page boundaries, though you shouldn't need to.
+ *
+ * Return value:
+ *     @dest
+ **/
+void *patch_memory(void *dest, const void *src, size_t size)
+{
+       size_t bytes_written, write_size;
+       unsigned long text_poke_addr;
+       unsigned long flags;
+
+       // If the poke area isn't set up, it's early boot and we
can just memcpy.
+       if (!this_cpu_read(text_poke_area))
+               return memcpy(dest, src, size);
+
+       local_irq_save(flags);

Do we want to do such potentially big copies with interrupts disabled
?

Probably not.  This should never actually get used for big copies - the
problem it was written to solve never copies more than 40 bytes, and is
very unlikely to ever cross a page boundary.

I could disable and re-enable interrupts per-page (per call of
do_patch_memory()) so there's a preemption window on longer operations.

quoted

+       text_poke_addr = (unsigned
long)__this_cpu_read(text_poke_area)->addr;
+
+       for (bytes_written = 0;
+            bytes_written < size;
+            bytes_written += write_size) {

I recommend you to read 
https://www.kernel.org/doc/html/latest/process/coding-style.html?highlight=coding%20style#naming

As explained there, local variable names should be short. Using long 
names is non-productive.

You could just call it "written", it would allow you to keep the
for() 
on a single line, that would be a lot more readable.

I am aware of the coding style, my brain somehow didn't consider
"written" as a better option, which is quite silly.

quoted

+               // Write as much as possible without crossing a
page boundary.
+               write_size = min_t(size_t,
+                                  size - bytes_written,
+                                  PAGE_SIZE - offset_in_page(dest
+ bytes_written));

Reduce the size of you variable names and keep it on a single line.

quoted

+
+               if (do_patch_memory(dest + bytes_written,
+                                   src + bytes_written,
+                                   write_size,
+                                   text_poke_addr))

Same, keep a single line as much as possible.

quoted

+                       break;
+       }
+
+       local_irq_restore(flags);
+
+       return dest;

Maybe it would be better to return ERR_PTR() of the error returned by
do_page_memory().

That is indeed much better.

Thanks for the feedback.

- Russell

quoted

+}
  #else /* !CONFIG_STRICT_KERNEL_RWX */
  
  static int do_patch_instruction(u32 *addr, struct ppc_inst instr)

@@ -185,6 +254,11 @@ static int do_patch_instruction(u32 *addr,

struct ppc_inst instr)
        return raw_patch_instruction(addr, instr);
  }
  
+void *patch_memory(void *dest, const void *src, size_t size)
+{
+       return memcpy(dest, src, size);
+}
+
  #endif /* CONFIG_STRICT_KERNEL_RWX */
  
  int patch_instruction(u32 *addr, struct ppc_inst instr)

Christophe